Latest / Diplomacy and International Relations / Cyber Diplomacy, AI, and Energy Security

Transcript

Cyber Diplomacy, AI, and Energy Security · Diplomacy and International Relations

• 0:00
  Welcome everyone. You are tuning into Diplomacy
• 0:02
  and International Relations by Bastin Freiborg.
• 0:06
  We've got a really complex set of source materials in front of
• 0:08
  us today, all focused on, well, the new frontier of
• 0:11
  international relations. We're talking about how cyber
• 0:14
  diplomacy is changing everything.
• 0:16
  And the massive shift being caused by artificial
• 0:18
  intelligence. Exactly.
• 0:20
  And the governance frameworks that are just struggling to keep
• 0:22
  pace with all of it. So our mission here is to
• 0:25
  synthesize this for you to give you a clear picture of the new
• 0:29
  rules of the road in the digital world.
• 0:31
  And hey, if you value this kind of analysis and want to support
• 0:34
  what we do, please make sure you follow and subscribe.
• 0:37
  There's also a small monthly subscription option on Spotify
• 0:40
  or Apple Podcast for some extra exclusive content.
• 0:43
  That link is right in the description.
• 0:45
  The main theme that just jumps out from all this material is
• 0:47
  the complete digital transformation of international
• 0:51
  relations. We are so far past cybersecurity
• 0:54
  being some niche technical topic.
• 0:56
  Oh, absolutely. It is now completely central to
• 0:59
  global security, to geopolitics, even just to keeping the lights
• 1:04
  on. So we really need to figure out
• 1:06
  who the key players are, what the new tools of conflict
• 1:09
  actually look like, and how governance is trying to manage
• 1:12
  this this incredibly volatile space.
• 1:15
  And you can almost trace the beginning of this whole field
• 1:18
  back to one specific moment. The world really woke up after
• 1:21
  the 2007 cyber attacks on Estonia.
• 1:24
  And what's really interesting, especially for our listeners, is
• 1:27
  the surprising role that smaller, digitally savvy
• 1:30
  countries, you know, like Denmark and Estonia, are now
• 1:32
  playing. They're setting the agenda.
• 1:34
  They really are. So let's unpack this.
• 1:36
  Let's start right there with that origin story.
• 1:37
  Right. So cyber diplomacy is a field.
• 1:39
  It was really born out of pure necessity and talent, and that
• 1:43
  2007 moment was the trigger. The attacks were sparked by a
• 1:47
  political decision, a really contentious one, to move a
• 1:50
  Soviet era War Memorial. And that sparked a digital
• 1:53
  retaliation. A massive one.
• 1:54
  It was politically motivated and deeply damaging.
• 1:57
  How? Damaging.
• 1:58
  Are we talking? Well, it was enough to cripple
• 2:01
  huge parts of Estonia's digital infrastructure.
• 2:04
  I mean, government websites, banks, media outlets, all of it
• 2:08
  went down. So it was a proof of concept in
• 2:10
  a way. Exactly.
• 2:11
  It showed the entire world that a country could be well
• 2:15
  effectively neutralized early, severely hobbled without a
• 2:18
  single shot being fired. It proved in really stark terms
• 2:23
  that digital resilience was now critical to national survival.
• 2:26
  And the sources show that Estonia didn't just bounce back,
• 2:29
  they did something much smarter. They took this horrible
• 2:31
  experience and basically turned it into diplomatic capital.
• 2:35
  They did. They turned a defensive failure
• 2:37
  into a huge diplomatic strength. So how did they manage to get
• 2:40
  that kind of outsized influence? Well, first, they already had a
• 2:43
  highly advanced digital society to build on.
• 2:46
  But crucially, they set up a dedicated department for cyber
• 2:49
  diplomacy. It's led by their ambassador at
• 2:52
  large, Tanel Sep. This very focused, high level
• 2:56
  effort gave Estonia a huge footprint in all the
• 2:59
  international talks about cyber governance.
• 3:01
  It's a perfect example of expertise driving influence, not
• 3:04
  just size. It's the new rule in the digital
• 3:06
  domain. Expertise and resilience matter
• 3:09
  more than traditional military or economic power.
• 3:12
  So that expertise gave them legitimacy and that turned into
• 3:15
  real diplomatic power. OK, that sets the stage
• 3:18
  perfectly for the next part, the formal rules.
• 3:21
  How do you govern a space where the conflict moves so much
• 3:24
  faster than the negotiations? Well, the main goal for, GOSH,
• 3:28
  the last two decades has been to develop these international
• 3:31
  norms for responsible state behavior in cyberspace.
• 3:35
  The big win the foundation is that everyone agrees that
• 3:38
  existing international law, specifically the UN Charter,
• 3:41
  applies to cyberspace. Right, but applying it is the
• 3:44
  hard part. That was the challenge,
• 3:46
  institutionalizing that consensus.
• 3:48
  And the sources point to a huge, very recent step forward on
• 3:51
  that. Front a massive 1.
• 3:52
  The big achievement was the adoption of the UN Permanent
• 3:55
  Global Mechanism in July 2025. This is huge because after
• 4:00
  nearly 20 years of really difficult negotiations. 20
• 4:03
  years, Why so long? Because things like attribution,
• 4:06
  proving who actually launched an attack, and then agreeing on
• 4:09
  what counts as a state sponsored act of aggression, it's
• 4:12
  incredibly difficult and it risks major geopolitical
• 4:16
  escalation. So what does a standing body do
• 4:19
  that the old ad hoc groups couldn't?
• 4:22
  It changes the entire conversation.
• 4:24
  It moves beyond just writing down norms.
• 4:26
  It creates a permanent, institutionalized place for
• 4:29
  dialogue, for capacity building, and critically, for confidence
• 4:33
  building measures. It ensures the conversation is
• 4:36
  continuous, not just a one off negotiation every few years.
• 4:39
  OK, so that's the UN, the state to state approach, but cyber is
• 4:43
  different. It's not just about governments.
• 4:45
  Absolutely not. And that's where things like the
• 4:47
  Paris Call for trust and security in cyberspace come in.
• 4:50
  It was launched back in November 2018.
• 4:52
  And that brings in private companies.
• 4:53
  Exactly. States yes, but also the private
• 4:56
  companies who actually build and run the Internet and civil
• 4:58
  society organizations. You need that combination
• 5:01
  because at the end of the day, the private sector owns and
• 5:05
  operates most of this critical infrastructure.
• 5:07
  And then regionally you have the EU stepping up.
• 5:10
  They have something called the EU Cyber Diplomacy Toolbox.
• 5:14
  Sounds like it gives them some leverage.
• 5:15
  It does. It gives them a formal playbook
• 5:17
  for diplomatic, political and economic responses.
• 5:21
  That includes sanctions that can be deployed when a member state
• 5:23
  or critical infrastructure is hit.
• 5:25
  It's designed to be a coordinated proportional
• 5:28
  response that isn't military. But has it been tested against a
• 5:32
  major state actor? I mean, the big test case was
• 5:35
  the SolarWinds attack, which the US pinned on Russia's SVR.
• 5:38
  It was a huge test and it showed the coordination can work even
• 5:42
  if deterrence is still a really complex problem.
• 5:45
  The response was fast and coordinated across the Atlantic.
• 5:48
  The US named Russia, issued sanctions, expelled diplomats.
• 5:51
  And the EU backed them up. Immediately a strong declaration
• 5:54
  of solidarity coordinated with the US sanctions.
• 5:57
  Now is it a perfect deterrent for high level espionage?
• 5:59
  No. But it demonstrated a united
• 6:01
  political front. OK, let's pivot from espionage
• 6:05
  to, well, actual conflict. We have to talk about the
• 6:08
  intersection of geopolitics and critical infrastructure, the
• 6:12
  energy sector specifically. This is where a global threat
• 6:15
  becomes a very local problem. The energy sector is a prime
• 6:18
  target. It has to be.
• 6:19
  It's increasingly run by digital control systems, so cyberattacks
• 6:23
  are now tools of power projection, of asymmetric
• 6:27
  warfare. The goal is to create chaos or
• 6:30
  just steal strategic plans. And we have a perfect and
• 6:33
  frankly terrifying Danish case study on this.
• 6:36
  In May 2023, Denmark was hit by its largest cyberattack on
• 6:40
  record. This was an abstract Russian
• 6:42
  hackers hit 22 Danish power companies. 22 The goal of that
• 6:46
  attack was to get comprehensive access to Denmark's entire
• 6:49
  decentralized power grid, right? They got in by exploiting known
• 6:52
  flaws, command injection, flaws in network gear, and then moving
• 6:55
  to other unpatched systems. It really highlights a paradox,
• 6:58
  doesn't it? A decentralized grid is supposed
• 7:00
  to be more resilient. To a physical attack, yes, but
• 7:03
  if the digital control systems are compromised across all those
• 7:05
  different nodes, you can get a cascading failure from a cyber
• 7:09
  attack that is incredibly damaging.
• 7:11
  And the data on who's doing the attacking is interesting.
• 7:14
  The general trend is, you know, Russia and China as origins. the
• 7:18
  US is a target. But for energy, it seems more
• 7:20
  specialized. That's right, the cluster
• 7:22
  analysis shows that for energy focused attacks the patterns are
• 7:25
  different. While BRICS countries might
• 7:27
  dominate non energy threats, the attacks on energy infrastructure
• 7:30
  often concentrated differently, often targeting NATO or EU
• 7:35
  countries for obvious geopolitical reasons.
• 7:38
  So with energy systems under constant threat, how are
• 7:41
  countries organizing to defend themselves in real time?
• 7:44
  The talent mechanism is a really interesting modern model for
• 7:47
  that. It was launched in December 2023
• 7:49
  by 11 countries, Canada, Denmark, Estonia among them.
• 7:53
  It's specifically focused on coordinating cyber assistance
• 7:56
  for Ukraine. To help them defend their energy
• 7:58
  grid from Russia. Precisely direct aid against
• 8:01
  Russia's persistent attacks on their infrastructure.
• 8:03
  And it's not a small effort, raising 200 million in its first
• 8:07
  year alone. That's a very Direct Line from
• 8:10
  diplomatic agreement to actual physical defense.
• 8:15
  All right, let's shift to the big accelerator in all of this
• 8:18
  artificial intelligence. It feels like AI is a total
• 8:21
  paradox. Here.
• 8:22
  It's both the most powerful weapon and the most critical
• 8:25
  shield. That's a perfect way to put it.
• 8:27
  AI applications, machine learning, natural language
• 8:30
  processing. They're already completely
• 8:32
  invade in modern cyber diplomacy on the defensive side.
• 8:36
  AI is just incredible at processing the huge volumes of
• 8:39
  unstructured data you need for predictive analytics.
• 8:41
  And we have some hard numbers on that.
• 8:43
  Generative AI models are now being used to sift through raw
• 8:45
  threat reports. You know, just text descriptions
• 8:47
  of attacks, and turn them into structured, usable intelligence.
• 8:50
  Correct. The analysis showed one Gen.
• 8:52
  AI model achieved 84% accuracy in classifying energy related
• 8:56
  incidents. But the key is speed and recall.
• 8:59
  The AI boosted analysis speed and got 77% recall on key data
• 9:03
  points. The old rule based systems only
• 9:05
  managed 66%. So that 11% difference means
• 9:08
  defenders can react to more incidents faster.
• 9:11
  But, and this is a huge but, Despite that efficiency, the
• 9:15
  sources reveal this staggering counter narrative when you look
• 9:19
  at actual threat detection. It is genuinely alarming.
• 9:22
  The static machine learning tools, the kind of thing used by
• 9:25
  big commercial security vendors like Akronis or Sentinelone.
• 9:29
  They only detected about 46.8% of malicious code related to
• 9:34
  these specialized energy threats.
• 9:36
  Less than half. I mean, that's shocking.
• 9:37
  They were completely outperformed by traditional
• 9:40
  antivirus engines which caught around 88.4%.
• 9:44
  So the big question is why are these hyped up cutting edge AI
• 9:48
  tools failing so badly in such a critical sector?
• 9:51
  What is going on there? It suggests the adversaries are
• 9:54
  getting very, very specific. They're customizing their
• 9:56
  malware. The payloads are low volume,
• 9:59
  maybe polymorphic, and they're designed explicitly to get
• 10:02
  around the specific behavioral models that these static ML
• 10:05
  tools are trained on. They're adapting faster than the
• 10:07
  defensive models can be updated. And while our defenses are
• 10:10
  struggling with that, the attackers are using AI without
• 10:12
  any hesitation. Absolutely.
• 10:14
  They're using the same large language models we are.
• 10:16
  We have documented cases a China based group called Sweet Specter
• 10:20
  is using open AI models for faster reconnaissance.
• 10:23
  And it gets more specific, right?
• 10:24
  Much more in Iranian affiliated group Cyber AV 3 Angers is using
• 10:29
  GT models to research programmable logic controllers
• 10:33
  LCS. Those are the industrial systems
• 10:35
  that run water plants and power grids.
• 10:37
  Another Iranian actor, Storm 081 scene, is using AI to debug
• 10:43
  their own malware. The implication is pretty clear
• 10:46
  with AI agents on both sides, you need some kind of governance
• 10:49
  framework and fast. How are we trying to put rules
• 10:51
  on these things before they just start fighting each other?
• 10:54
  The NIST Cybersecurity Framework 2 point O is a good starting
• 10:56
  point. It breaks security into six
• 10:58
  functions, govern, identify, protect, detect, respond, and
• 11:02
  recover. And researchers are now trying
• 11:04
  to map different AI agent types, Reactive cognitive Learning
• 11:07
  agents, to those specific functions.
• 11:09
  Give me an example of that. How does that work in practice?
• 11:11
  So a simple reactive agent, one that just follows rules, might
• 11:15
  be mapped to the detect function for real time anomaly detection,
• 11:19
  but a more advanced cognitive agent, one that can reason and
• 11:22
  plan, would be used for higher level strategy in the govern or
• 11:25
  respond functions. The idea is to make sure AI
• 11:28
  isn't just a chaotic black box. So that's about integrating AI
• 11:32
  responsibly now. But looking down the road, the
• 11:35
  really big, almost existential threat isn't current AI, it's
• 11:40
  the quantum threat. That's right, quantum computing
• 11:42
  could in theory break most of the encryption we rely on today
• 11:46
  for everything. Diplomatic cables, military
• 11:49
  systems, all of our financial transactions.
• 11:51
  This requires urgent international cooperation on
• 11:53
  post quantum crypto standards now, before the threat is fully
• 11:56
  realized. Which brings this whole
• 11:58
  conversation right back to where we started, back to the basic
• 12:00
  rules of the road. The foundational UN norms about
• 12:03
  critical infrastructure are more important than ever, regardless
• 12:06
  of the tech that. Foundation is everything you
• 12:09
  have to keep coming back to UN Norm 6.
• 12:11
  Who says nation should not damage or support activity that
• 12:14
  damages another nation's critical infrastructure?
• 12:16
  And norm 7, which requires states to take appropriate
• 12:18
  measures to rotect their own critical infrastructure.
• 12:21
  These two norms are the bedrock O.
• 12:23
  To sum it U, cyber diplomacy is just it's inseparable from
• 12:28
  geopolitics now. The future isn't about choosing
• 12:30
  between humans or AI, it's about finding the best combination of
• 12:34
  human judgement and artificial intelligence, especially in a
• 12:37
  field as high stakes as energy security.
• 12:39
  Which leads us perfectly to our final provocative thought for
• 12:42
  you to consider. Given that catastrophic failure
• 12:45
  of static machine learning tools to detect specialized malware in
• 12:48
  the energy sector, what does that really tell you about the
• 12:52
  risk of relying too heavily on so-called autonomous defenses?
• 12:56
  What does responsible DI deployment even look like if the
• 12:58
  machines are being outsmarted in our most critical sectors?
• 13:02
  And how do we guarantee that the human element always, always
• 13:05
  remains the final arbiter in this incredibly volatile domain?
• 13:09
  Thank you so much for joining us for this analysis.
• 13:11
  If you enjoyed this exploration, please be sure to follow the
• 13:13
  program and maybe take a moment to rate US five stars.
• 13:15
  It really helps us reach more people.
• 13:17
  We'll be back with another fascinating session very soon.